pluginsign

sub2api-pluginsign

Ed25519 签名和验证库，用于 sub2api 插件市场的插件完整性验证。

功能特性

• ✅ Ed25519 签名生成和验证
• ✅ 插件 manifest 和 checksums 签名
• ✅ 信任密钥存储管理（TrustStore）
• ✅ 密钥吊销检查
• ✅ 运行时兼容性验证
• ✅ SHA256 checksum 验证

安装

go get github.com/IanShaw027/sub2api-pluginsign@latest

快速开始

签名生成

package main

import (
    "github.com/IanShaw027/sub2api-pluginsign"
)

func main() {
    // 生成密钥对
    kp, _ := pluginsign.GenerateKeyPair("my-key-1")

    // 创建 manifest
    manifest := pluginsign.Manifest{
        ID:               "example.plugin",
        Version:          "1.0.0",
        Runtime:          "wasm",
        PluginAPIVersion: "1.0.0",
        SHA256:           "abc123...",
        Compatibility: pluginsign.Compatibility{
            MinPluginAPIVersion: "1.0.0",
            MaxPluginAPIVersion: "1.9.0",
        },
    }

    // 签名
    checksums := map[string]string{
        "plugin.wasm": "abc123...",
    }
    signature, _ := kp.SignManifest(manifest, checksums)
}

签名验证

// 加载信任存储
store, _ := pluginsign.LoadTrustStoreFromFiles(pluginsign.TrustStoreFileSet{
    OfficialKeysPath:  "official_keys.json",
    CommunityKeysPath: "community_keys.json",
    RevokedKeysPath:   "revoked_keys.json",
})

// 验证安装
err := pluginsign.VerifyInstall(pluginsign.VerifyInstallRequest{
    Manifest:             manifest,
    Checksums:            checksums,
    ArtifactBytes:        wasmBytes,
    Signature:            signature,
    KeyID:                "my-key-1",
    HostRuntime:          "wasm",
    HostPluginAPIVersion: "1.5.0",
    TrustStore:           store,
})

密钥文件格式

公钥文件

{
  "keys": [
    {
      "key_id": "official-key-1",
      "public_key": "BASE64_ENCODED_PUBLIC_KEY"
    }
  ]
}

吊销列表

{
  "revoked_key_ids": ["revoked-key-1", "revoked-key-2"]
}

验证流程

1. 验证 manifest 字段完整性
2. 检查运行时兼容性
3. 验证工件 SHA256 checksum
4. 验证 Ed25519 签名
5. 检查密钥是否被吊销

错误码

测试

go test -v ./...
go test -cover ./...

许可证

MIT License

相关项目

• sub2api - 主项目
• sub2api-plugin-market - 插件市场